The mysql command-line client does not quote HTML special characters
like < in its output. This allows an attacker who is able to write data
into a table to hide or modify records in the output, and to inject
potentially dangerous code, e. g. Javascript to perform cross-site
scripting or cross-site request forgery attacks.